push-pr-lint.yaml

name: lint, test and build image
on: [pull_request, push]

jobs:
  lint-test:
    runs-on: ubuntu-latest
    steps:
    - name: Install Go
      uses: actions/setup-go@v4
      with:
        go-version: '1.19'
    - name: Checkout code
      uses: actions/checkout@v3
    - name: golangci-lint
      uses: golangci/golangci-lint-action@v3
      with:
        args: --config .golangci.yml --timeout 2m
        version: v1.50.0
    - name: Test
      run: go test ./...
  build:
    runs-on: ubuntu-latest
    needs: [lint-test]
    steps:
      - name: Install Go
        uses: actions/setup-go@v4
        with:
          go-version: '1.19'

      - name: Checkout code
        uses: actions/checkout@v3

      - name: build binary
        run: make build-linux

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Build Alloy Docker image - no push
        id: dockerbuild-alloy
        uses: docker/build-push-action@v4
        with:
           context: .
           push: false
           tags: ghcr.io/metal-toolbox/alloy:latest
           file: Dockerfile

      - name: Scan image - Alloy
        id: scan-Alloy-image
        uses: anchore/scan-action@v3
        with:
          image: ghcr.io/metal-toolbox/alloy:latest
          acs-report-enable: true
          # TODO(joel): Fail build once we migrate off CentOS.
          fail-build: false

      # TODO(joel): Uncomment once we migrate off CentOS.
      # - name: upload Anchore scan SARIF report
      #   uses: github/codeql-action/upload-sarif@v2
      #   with:
      #     sarif_file: ${{ steps.scan.outputs.sarif }}
      #   # This should run even if we fail the container scan
      #   if: always()

      - name: Inspect action SARIF report
        run: cat ${{ steps.scan.outputs.sarif }}
        # This should run even if we fail the container scan
        if: always()